The present invention relates to a safety switching apparatus for failsafe disconnection of an electrical load, in particular in an automatically operated installation. In particular embodiments, the invention relates to a compact safety switching device having redundant relay contacts for disconnecting a power supply path to the load.
Safety switching apparatuses in terms of the present invention are typically used in order to switch off a dangerous machine or installation in a failsafe manner when this is necessary to protect personnel. The safety switching apparatuses typically monitor the signals from emergency-off buttons, protective-door switches, light barriers, light grids and other safety signaling devices, and they are designed to interrupt an electrical power supply path as a function of these signals. As can easily be understood, it is of major importance to ensure the safety function, which means that faults in the area of the safety switching apparatus are either brought under control and/or are identified at an early stage. Safety switching apparatuses therefore typically have a redundant design and/or build-in self-test functions. At least when the safety requirements are stringent, the signals to the safety switching apparatus are also designed to be redundant.
The fail safety which can be achieved by the redundancy is lost, however, if a short occurs in the connecting lines between the signaling devices and the safety switching apparatus. A safety switching apparatus in accordance with higher level safety categories 3 and 4 of European Standard EN 954-1 (or in accordance with similar requirements) therefore requires short identification. In a prior art safety switching device manufactured and sold by the assignee Pilz GmbH & Co. KG under the brand name PNOZ® X2, this is achieved in that a two-channel signaling device, for example an emergency-off button with two redundant break contacts, is connected by separate lines to the connecting terminals, with the first potential being applied to a first break contact of the emergency-off button, while a second potential is applied to the second break contact. The operating voltage, for example of 24 V, is typically used as the first potential while the second potential is an opposing potential, in particular ground potential. Internally, the safety switching apparatus is designed such that a short between the connecting lines of the signaling device, for example as a result of a cable being crushed, leads to an electrical short circuit in the safety switching apparatus, and this short circuit results in a major rise in the current flowing into the safety switching apparatus. The increased current trips a fuse which is arranged in the input circuit of the safety switching apparatus. As a result, the output switching elements are switched off. This known approach, however, has the disadvantage that the trigger point at which the fuse is tripped (as an overcurrent identification element) is dependent on the temperature, and is therefore inaccurate.
DE 44 23 704 C1 discloses another approach for identification of shorts in safety switching apparatuses. In this case, each of the output sided switching elements is connected to a common ground potential with one of their terminals, while the respective other terminals are connected to a different positive and negative potential. This approach, however, is dependent on the safety switching apparatus being supplied with an AC voltage, from which the positive and negative potentials are produced. This known approach therefore cannot be transferred directly to safety switching apparatuses which are supplied with DC voltage.
DE 197 58 332 B4 discloses another safety switching apparatus, wherein an overcurrent identification element in the form of an electronic fuse is used in the input circuit. In order to prevent an automatic restart of a monitored machine or installation after a short has been rectified, an optocoupler is arranged in parallel with the fuse in this case. When the fuse trips, the optocoupler short circuits the input circuit of the safety switching apparatus and latches itself in this position. This known safety switching apparatus, however, has the disadvantage mentioned above, namely the tripping point of the fuse is dependent on temperature and is therefore inaccurate.
In addition to the approaches discussed so far, namely approaches using steady-state potentials on the signaling lines, there are also dynamic approaches for identification of shorts. For example, reference is made to DE 100 33 073 A1, DE 197 02 009 C2 and DE 198 05 722 A1. The dynamic approaches use signals having different clocks on the connecting lines to the signaling devices. The signals on the separate signaling lines can therefore be distinguished from one another, and a short can be identified. Dynamic approaches have the disadvantage that at least two different clock signals must be provided, which involves complexity and makes the devices more expensive.